Isolated networks

[PurpleCloud]

Hello,
I'm using proxmox in a test lab, and i would like to create isolated LAN, simulating real customers. Considering one VMBR by customer, my network configuration is the following :

auto lo
iface lo inet loopback

iface enp5s0f0 inet manual

iface enp5s0f1 inet manual

auto vmbr0
iface vmbr0 inet static
        address (public_ip)/24
        gateway (gateway)
        bridge-ports enp5s0f0
        bridge-stp off
        bridge-fd 0
        hwaddress A0:42:3F:3D:0F:FC

auto vmbr1 #LAN CUSTOMER 1
iface vmbr1 inet static
        address 192.168.10.250/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

auto vmbr2 #LAN CUSTOMER 2
iface vmbr2 inet static
        address 192.168.20.250/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
post-up   iptables -t nat -A POSTROUTING -s '192.168.10.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.10.0/24' -o vmbr0 -j MASQUERADE

I have 2 VM :
VM1 in 192.168.10.20
VM2 in 192.168.20.20

In this setup, both VM can ping the other VM and the gateways.

My goal is to permit the out trafic for the 2 VM, but isolate the networks between them.
I probably can isolate the networks with firewall rules, but i would prefer to limit the routing.
Is anybody could show me the correct way or a link to te right setup ?

Thanks in advance

 

[PurpleCloud]

Can someone help me?

 

[spirit]

Hi, I'm currently working on this for sdn, with adding vrf support on simple zone, (each customer in a different zone/vrf) but it's not yet ready.

 

[PurpleCloud]

Hi, I'm currently working on this for sdn, with adding vrf support on simple zone, (each customer in a different zone/vrf) but it's not yet ready.

Thanks for your answer. Is the VRF support outside from the proxmox stack ? Or you build it from inside the proxmox host (pvesdn ?) ?